corysanin/tubestation
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bug 1176681 - Make character buffer allocations in the HTML5 tree builder fallible. r=wchen.

Browse Source
This commit is contained in:
Henri Sivonen
2015-08-25 18:05:46 +03:00
parent bee2d42d10
commit c02fb472a7
4 changed files with 91 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
parser/html/nsHtml5StreamParser.cpp
View File

@@ -1369,9 +1369,14 @@ nsHtml5StreamParser::ParseAvailableData()
}
if (NS_SUCCEEDED(mTreeBuilder->IsBroken())) {
mTokenizer->eof();
mTreeBuilder->StreamEnded();
if (mMode == VIEW_SOURCE_HTML || mMode == VIEW_SOURCE_XML) {
mTokenizer->EndViewSource();
nsresult rv;
if (NS_FAILED((rv = mTreeBuilder->IsBroken()))) {
MarkAsBroken(rv);
} else {
mTreeBuilder->StreamEnded();
if (mMode == VIEW_SOURCE_HTML || mMode == VIEW_SOURCE_XML) {
mTokenizer->EndViewSource();
}
}
}
FlushTreeOpsAndDisarmTimer();
@@ -1394,6 +1399,11 @@ nsHtml5StreamParser::ParseAvailableData()
return;
}
mLastWasCR = mTokenizer->tokenizeBuffer(mFirstBuffer);
nsresult rv;
if (NS_FAILED((rv = mTreeBuilder->IsBroken()))) {
MarkAsBroken(rv);
return;
}
// At this point, internalEncodingDeclaration() may have called
// Terminate, but that never happens together with script.
// Can't assert that here, though, because it's possible that the main